Techniques › T1505 › T1505.003
T1505.003 Web Shell
persistence — Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
35
Sigma rules tagged attack.t1505.003
26
KEV CVEs mapped here
<p>Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.</p><p>In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. China Chopper Web shell client).</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-35939 | Craft CMS Craft CMS | primary impact | Mapped | 2025-06-02 |
| CVE-2025-4427 | Ivanti Endpoint Manager Mobile (EPMM) | secondary impact | Mapped | 2025-05-19 |
| CVE-2025-42999 | SAP NetWeaver | secondary impact | Mapped | 2025-05-15 |
| CVE-2025-31324 | SAP NetWeaver | exploitation technique | Mapped | 2025-04-29 |
| CVE-2025-3928 | Commvault Web Server | secondary impact | Mapped | 2025-04-28 |
| CVE-2023-20118 | Cisco Small Business RV Series Routers | secondary impact | Mapped | 2025-03-03 |
| CVE-2024-21893 | Ivanti Connect Secure, Policy Secure, and Neurons | secondary impact | Mapped | 2024-01-31 |
| CVE-2023-46805 | Ivanti Connect Secure and Policy Secure | secondary impact | Mapped | 2024-01-10 |
| CVE-2024-21887 | Ivanti Connect Secure and Policy Secure | secondary impact | Mapped | 2024-01-10 |
| CVE-2023-32315 | Ignite Realtime Openfire | primary impact | Mapped | 2023-08-24 |
| CVE-2023-26360 | Adobe ColdFusion | secondary impact | Mapped | 2023-03-15 |
| CVE-2023-22952 | SugarCRM Multiple Products | secondary impact | Stale | 2023-02-02 |
| CVE-2022-41082 | Microsoft Exchange Server | secondary impact | Mapped | 2022-09-30 |
| CVE-2022-22963 | VMware Tanzu Spring Cloud | secondary impact | Mapped | 2022-08-25 |
| CVE-2022-22954 | VMware Workspace ONE Access and Identity Manager | primary impact | Mapped | 2022-04-14 |
| CVE-2021-27860 | FatPipe WARP, IPVPN, and MPVPN software | primary impact | Mapped | 2022-01-10 |
| CVE-2021-44228 | Apache Log4j2 | secondary impact | Mapped | 2021-12-10 |
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | primary impact | Mapped | 2021-12-01 |
| CVE-2020-0688 | Microsoft Exchange Server | secondary impact | Mapped | 2021-11-03 |
| CVE-2021-26855 | Microsoft Exchange Server | secondary impact | Mapped | 2021-11-03 |
| CVE-2021-26858 | Microsoft Exchange Server | primary impact | Mapped | 2021-11-03 |
| CVE-2021-27065 | Microsoft Exchange Server | primary impact | Mapped | 2021-11-03 |
| CVE-2019-0604 | Microsoft SharePoint | primary impact | Mapped | 2021-11-03 |
| CVE-2021-26857 | Microsoft Exchange Server | primary impact | Mapped | 2021-11-03 |
| CVE-2019-18935 | Progress Telerik UI for ASP.NET AJAX | primary impact | Mapped | 2021-11-03 |
| CVE-2021-40539 | Zoho ManageEngine | primary impact secondary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0394 Web Shell Detection via Server Behavior and File Execution Chains v1.0
AN1108 WindowsUnexpected file creation in web directories followed by web server processes (e.g., w3wp.exe) spawning command shells or script interpreters (e.g., cmd.exe, powershell.exe)NSM:Flow
Inbound HTTP POST with suspicious payload size or user-agent→ DC0085 Network Traffic ContentTunable:WebRootPathParentProcessAN1109 LinuxFile creation of unauthorized script (e.g., .php, .sh) in /var/www/html followed by execution of unexpected system utilities (e.g., curl, bash, nc) by apache/nginxauditd:SYSCALLnew file created in /var/www/html, /srv/http, or similar web root→ DC0039 File CreationNSM:FlowPOST requests to .php, .jsp, .aspx files with high entropy body→ DC0085 Network Traffic ContentTunable:WebRootPathPayloadEntropyThresholdTimeWindowAN1110 macOSWeb servers (e.g., httpd) spawning abnormal processes post file upload into /Library/WebServer/Documents or /usr/local/var/wwwTunable:InterpreterNameExecutionParent
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1505.003
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-07-24 · logsource: product=windows category=file_event · 1f0489be-b496-4ddf-b3a9-5900f2044e9c
Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation.
This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
Author: Jason Rathbun (Blackpoint Cyber)
· 2025-04-17 · logsource: product=windows category=process_creation · 2d79e371-2a27-42de-87a4-b4213fc72a6a
Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)
Author: Cian Heasley
· 2020-08-04 (modified 2023-01-02) · logsource: category=webserver · 2ea44a60-cfda-11ea-87d0-0242ac130003
Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.
Author: Florian Roth (Nextron Systems)
· 2019-01-16 (modified 2024-01-18) · logsource: product=windows category=process_creation · 35efb964-e6a5-47ad-bbcd-19661854018d
Detects a program executing from a web server root folder. Use this rule to hunt for potential interesting activity such as webshell or backdoors
Author: Florian Roth (Nextron Systems)
· 2018-07-22 (modified 2023-01-02) · logsource: category=webserver · 37e8369b-43bb-4bf8-83b6-6dd43bda2000
Detects access to a webshell dropped into a keystore folder on the WebLogic server
Author: Beyu Denis, oscd.community, Tim Shelton, Thurein Oo
· 2019-10-22 (modified 2023-10-15) · logsource: product=windows category=file_event · 39f1f9f2-9636-45de-98f6-a4046aa8e4b9
Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-03 (modified 2023-07-28) · logsource: category=webserver · 435e41f2-48eb-4c95-8a2b-ed24b50ec30b
Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362
Author: Florian Roth (Nextron Systems)
· 2022-03-17 (modified 2023-11-09) · logsource: product=windows category=process_creation · 4ebc877f-4612-45cb-b3a5-8e3834db36c9
Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system
Author: Florian Roth (Nextron Systems), Rich Warren, Christian Burkard (Nextron Systems)
· 2021-08-09 (modified 2023-04-30) · logsource: product=windows service=msexchange-management · 516376b4-05cd-4122-bae0-ad7641c38d48
Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-14 · logsource: category=webserver · 639b893f-f93a-4e53-a7c8-f08cf73fe7f7
Detects potential Java webshell uploads via HTTP requests with Content-Type 'application/octet-stream' and Java file extensions.
This behavior might indicate exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution through webshells in SAP NetViewer.
Author: Florian Roth (Nextron Systems)
· 2022-10-04 · logsource: product=windows category=file_event · 6b269392-9eba-40b5-acb6-55c882b20ba6
Detects suspicious file type dropped by an Exchange component in IIS
Author: Florian Roth (Nextron Systems)
· 2022-02-25 · logsource: product=windows category=file_event · 7280c9f3-a5af-45d0-916a-bc01cb4151c9
Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2017-02-19 (modified 2022-11-18) · logsource: category=webserver · 7ff9db12-1b94-4a79-ba68-a2402c5d6729
Detects common commands used in Windows webshells
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2021-10-15 (modified 2026-08-19) · logsource: product=linux category=process_creation · 818f7b24-0fba-4c49-a073-8b755573b9c7
Detects suspicious sub processes of web server processes
Author: Thomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
· 2019-01-16 (modified 2024-11-26) · logsource: product=windows category=process_creation · 8202070f-edeb-4d31-a010-a26c72ac5600
Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation
Author: FPT.EagleEye Team, wagga
· 2020-12-11 (modified 2023-05-04) · logsource: product=windows category=process_creation · 869b9ca7-9ea2-4a5a-8325-e80e62f75445
Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-20 · logsource: product=windows category=file_event · 89c42960-f244-4dad-9151-ae9b1a3287a2
Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers.
This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts.
Author: Florian Roth (Nextron Systems)
· 2019-12-11 (modified 2024-03-13) · logsource: product=windows category=process_creation · 9465ddf4-f9e4-4ebd-8d98-702df3a93239
Detects suspicious IIS native-code module installations via command line
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-14 · logsource: category=webserver · 94e12f41-6cb3-45c5-97b1-c783a7bf2e72
Detects potential command execution via webshell in SAP NetViewer through JSP files with cmd parameter.
This rule is created to detect exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution via a webshell.
Author: Jose Rodriguez @Cyb3rPandaH
· 2021-03-15 (modified 2023-01-23) · logsource: product=windows service=msexchange-management · 9db37458-4df2-46a5-95ab-307e7f29e675
Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-06 (modified 2023-01-02) · logsource: category=webserver · 9f6a34b4-2688-4eb7-a7f5-e39fef573d0e
Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-07-19 (modified 2023-01-02) · logsource: category=webserver · a133193c-2daa-4a29-8022-018695fcf0ae
Detects attempts to exploit a Rejetto HTTP File Server (HFS) via CVE-2014-6287
Author: Florian Roth (Nextron Systems)
· 2020-12-17 (modified 2023-01-02) · logsource: category=webserver · a2cee20b-eacc-459f-861d-c02e5d12f1db
Detects access to SUPERNOVA webshell as described in Guidepoint report
Author: Max Altgelt (Nextron Systems)
· 2021-08-23 (modified 2023-01-23) · logsource: product=windows service=msexchange-management · b7bc7038-638b-4ffd-880c-292c692209ef
Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell
Author: Florian Roth (Nextron Systems), MSTI (query, idea)
· 2022-10-01 · logsource: product=windows category=file_event · bd1212e5-78da-431e-95fa-c58e3237a8e6
Detects suspicious file type dropped by an Exchange component in IIS into a suspicious folder
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-20 · logsource: product=windows category=process_creation · bd3b3fff-a018-4994-9876-68af5809160f
Detects the use of qoperation.exe with the -file argument to write a JSP file to the webroot, indicating a webshell drop.
This is a post-authentication step corresponding to CVE-2025-57790.
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson
· 2017-01-01 (modified 2026-07-14) · logsource: product=windows category=process_creation · bed2a484-9348-4143-8a8a-b801c979301c
Detects certain command line parameters often used during reconnaissance activity via web shells
Author: Ilyas Ochkov, Beyu Denis, oscd.community
· 2019-10-12 (modified 2025-12-05) · logsource: product=linux service=auditd · c0d3734d-330f-4a03-aae2-65dacc6a8222
Detects possible command execution by web application/web shell
Author: Florian Roth (Nextron Systems)
· 2017-03-14 (modified 2022-10-09) · logsource: product=linux · c67e0c98-4d39-46ee-8f6b-437ebf6b950e
Detects shellshock expressions in log files
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-19 · logsource: category=webserver · c9e6f412-3d50-4f7e-bf94-5b6c7d8e9f0a
Detects post-exploitation access to the wp2shell webshell plugin dropped after successful
exploitation of CVE-2026-63030 and CVE-2026-60137. After the pre-auth SQLi-to-admin bridge is established,
the attacker can upload a malicious plugin (wp2shell) to the target WordPress instance.
At this phase, the attacker accesses the webshell for command execution and persistence.
Author: Cian Heasley, Florian Roth (Nextron Systems)
· 2020-07-22 (modified 2023-11-09) · logsource: product=windows category=process_creation · f64e5c19-879c-4bae-b471-6d84c8339677
Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands
Author: Florian Roth (Nextron Systems), MSTI (query)
· 2022-10-01 · logsource: product=windows category=process_creation · fa3c117a-bc0d-416e-a31b-0c0e80653efb
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
Author: Sittikorn S, Nuttakorn Tungpoonsup
· 2021-09-10 (modified 2023-01-02) · logsource: category=webserver · fcbb4a77-f368-4945-b046-4499a1da69d1
Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).
Author: Florian Roth (Nextron Systems), Arnim Rupp
· 2018-09-09 (modified 2026-06-29) · logsource: category=antivirus · fdf135a2-9241-4f96-a114-bb404948f736
Detects a highly relevant Antivirus alert that reports a web shell.
It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Author: Florian Roth (Nextron Systems)
· 2021-02-22 (modified 2023-01-02) · logsource: category=webserver · fdf96c90-42d5-4406-8a9c-14a2c9a016b5
Detects access to DEWMODE webshell as described in FIREEYE report
Rules tagged at the parent level (attack.t1505) 1
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Austin Clark
· 2019-08-12 (modified 2025-04-28) · logsource: product=cisco service=aaa · 671ffc77-50a7-464f-9e3d-9ea2b493b26b
Modifications to a config that will serve an adversary's impacts or persistence